Content Security Policy

The theme writes no inline JavaScript. Its settings travel as JSON data blocks and all of its code comes from script files, so your site can be served with a strict Content Security Policy.

Policy

This policy covers every feature of the theme except Mermaid

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:

style-src-attr 'unsafe-inline' allows style attributes: the theme writes colors and image sizes given in your content as such, and Hugo colors highlighted code this way unless you set markup.highlight.noClasses=false. If none of this applies, you use no Mermaid and your math output is mathml, you can leave it out: Mermaid and the other math outputs write style attributes as well. Inline <style> elements stay forbidden; the theme writes none.

What Needs More

• Mermaid: Mermaid writes its styles into inline <style> elements. Add style-src-elem 'self' 'unsafe-inline' - with 'self' repeated, as it replaces style-src for all style elements.
• Inlined SVGs: an SVG shown with the inlinecontent image effect brings its own <style> elements into the page, if it has any, and needs the same style-src-elem.
• Libraries from elsewhere: if you set customMermaidURL or customOpenapiURL, add their origin to script-src, and for Swagger UI to style-src as well.
• Your own inline JavaScript: a javascript: URL as the href of a button, card or topbar button is blocked. Give it an action instead and handle that in a script file.

Subresource Integrity

Set enableSubresourceIntegrity=true to have the theme add an integrity hash to each script and stylesheet it links, including the search index and the stylesheets of the OpenAPI shortcode. A browser then refuses a file that changed after the build.

[params]
  enableSubresourceIntegrity = true

params:
  enableSubresourceIntegrity: true

{
   "params": {
      "enableSubresourceIntegrity": true
   }
}